> it could easily be defamatory if you went on to claim that this was therefore routine or a serious problem.
Claiming that the problem is "routine" might be problematic, but I think the problem being "serious" may arguably be non-defamatory. A problem being "routine" implies there's a pattern, which can potentially be proven/disproven, but whether a problem is "serious" seems much more opinion-based. One advertiser may not care that their ads have a minuscule chance of showing up next to objectionable content, and another one may care very much that there's a non-zero chance.
For example imagine that it takes exploits, URL editing, or something similar to do it. The question here really is how much effort you really need to put in to get it to happen.